Google Gemini Media

PassAudited by VirusTotal on May 12, 2026.

Overview

Type: OpenClaw Skill Name: google-gemini-media Version: 1.0.1 The skill provides instructions and code examples for interacting with the Google Gemini API for multimodal media tasks. All file system operations (e.g., `fs.readFileSync`, `fs.writeFileSync`) and network calls (`curl`, `@google/genai` SDK) are directly aligned with the stated purpose of processing and generating media. The use of `GEMINI_API_KEY` from environment variables is for legitimate API authentication, and there is no evidence of data exfiltration, malicious execution, persistence mechanisms, or prompt injection attempts against the OpenClaw agent. The content is clearly instructional and lacks any high-risk behaviors beyond what is necessary for its stated functionality.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI03: Identity and Privilege Abuse

What this means

Using the skill requires a Gemini API key that may incur quota or billing usage under the user's account.

Why it was flagged

The skill requires authenticated access to the user's Gemini account/API quota. This is expected for the stated integration, but the registry metadata lists no primary credential or required env vars.

Skill content

Put your API key in `GEMINI_API_KEY`; REST requests use `x-goog-api-key: $GEMINI_API_KEY`

Recommendation

Set the key only in the intended environment, avoid hardcoding it in prompts or files, and use a key scoped and monitored for Gemini API usage.

Note

ASI07: Insecure Inter-Agent Communication

What this means

Images, audio, or video provided to these workflows may be transmitted to Google services for processing.

Why it was flagged

The skill explicitly supports uploading media to Google's Files API and reusing file URIs for large files or multi-turn workflows.

Skill content

Files API (upload then reference)... `files.upload(...)` ... Use `file_data` / `file_uri` in `generateContent`

Recommendation

Upload only media you intend to process with Gemini, review applicable Google data handling policies, and delete or limit reuse of uploaded files where appropriate.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing the SDK pulls code from the npm ecosystem into the user's project.

Why it was flagged

The skill suggests installing an external npm package without a pinned version. This is a normal setup step for the Gemini SDK, but users should verify package provenance.

Skill content

Install SDK (example):
```bash
npm install @google/genai
```

Recommendation

Install the official @google/genai package from a trusted registry, consider pinning a version, and follow normal dependency review practices.